{"id":"CVE-2025-49125","aliases":["ALSA-2025:14177","ALSA-2025:14178","ALSA-2025:14181","BIT-tomcat-2025-49125","CLSA-2025-1753056170","CLSA-2025-1756253007","CLSA-2025-1759795579","CLSA-2025-1764720465","CLSA-2025-1765411683","CLSA-2025-1766362095","CLSA-2026-1768262917","CLSA-2026-1773188120","CLSA-2026-1781744120","CLSA-2026-1786763497","CLSA-2026-1792575257","CLSA-2026-1792667085","CLSA-2026-1793011037","CLSA-2026-1793011786","CLSA-2026-1793202343","DEBIAN-CVE-2025-49125","DLA-4244-1","DSA-6120-1","DSA-6121-1","EUVD-2025-18406","GHSA-wc4r-xq3c-5cf3","MGASA-2025-0191","OESA-2025-1644","OESA-2025-1816","RHSA-2025:11695","RHSA-2025:11741","RHSA-2025:14177","RHSA-2025:14178","RHSA-2025:14179","RHSA-2025:14180","RHSA-2025:14181","RHSA-2025:14182","RHSA-2025:14183","RLSA-2025:14177","RLSA-2025:14178","RLSA-2025:14179","RLSA-2025:14181","SUSE-SU-2025:02214-1","SUSE-SU-2025:02261-1","SUSE-SU-2025:02280-1","SUSE-SU-2025:02978-1","SUSE-SU-2025:02979-1","SUSE-SU-2025:03024-1","SUSE-SU-2026:1058-1","UBUNTU-CVE-2025-49125","openSUSE-SU-2025:15301-1","openSUSE-SU-2025:15302-1","openSUSE-SU-2025:15303-1"],"status":"published","title":"Apache Tomcat: Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.03437,"percentile":0.89123,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-288"],"published":"2025-06-16T14:18:09Z","modified":"2026-11-11T09:39:14Z","exploits":[{"source":"pocgithub","id":"gregk4sec/CVE-2025-49125","title":"gregk4sec/CVE-2025-49125","date":"2025-06-03","url":"https://github.com/gregk4sec/CVE-2025-49125"}],"fixes":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["11.0.8","10.1.42","9.0.106"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["11.0.8","10.1.42","9.0.106"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"tomcat","fixed_in":["9.0.106","10.1.42","11.0.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","fixed_in":["8.5.100.tuxcare.2","9.0.90-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","fixed_in":["8.5.100.tuxcare.2","9.0.90-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat10","fixed_in":["10.1.52-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat10","fixed_in":["10.1.52-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat10","fixed_in":["10.1.46-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat11","fixed_in":["11.0.15-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat11","fixed_in":["11.0.11-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tomcat9","fixed_in":["9.0.70-2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.7"},{"fixed":"11.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.41"},{"fixed":"10.1.42"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.105"},{"fixed":"9.0.106"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"last_affected":"11.0.7"},{"fixed":"11.0.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"last_affected":"10.1.41"},{"fixed":"10.1.42"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"last_affected":"9.0.105"},{"fixed":"9.0.106"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Bitnami","package":"tomcat","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"9.0.106"},{"introduced":"10.0.0"},{"fixed":"10.1.42"},{"introduced":"11.0.0"},{"fixed":"11.0.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.2"}]}],"versions":["8.5.100","8.5.100.tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.100"},{"fixed":"8.5.100.tuxcare.2"}]}],"versions":["8.5.100","8.5.100.tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.75"},{"fixed":"9.0.75-tuxcare.1"}]}],"versions":["9.0.75"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.83"},{"fixed":"9.0.83-tuxcare.1"}]}],"versions":["9.0.83"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.50"},{"fixed":"9.0.50-tuxcare.2"}]}],"versions":["9.0.50","9.0.50-tuxcare.1"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.87"},{"fixed":"9.0.87-tuxcare.1"}]}],"versions":["9.0.87"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.1"}]}],"versions":["9.0.100"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.1"}]}],"versions":["9.0.100"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.1"}]}],"versions":["9.0.100"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.100"},{"fixed":"9.0.100-tuxcare.1"}]}],"versions":["9.0.100"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.18"},{"fixed":"10.1.18-tuxcare.1"}]}],"versions":["10.1.18"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.46"},{"fixed":"9.0.46-tuxcare.1"}]}],"versions":["9.0.46"],"bundled":23},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.8"}]}],"versions":["9.0.90","9.0.90-tuxcare.1","9.0.90-tuxcare.2","9.0.90-tuxcare.3","9.0.90-tuxcare.4","9.0.90-tuxcare.5","9.0.90-tuxcare.6","9.0.90-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.90"},{"fixed":"9.0.90-tuxcare.8"}]}],"versions":["9.0.90","9.0.90-tuxcare.1","9.0.90-tuxcare.2","9.0.90-tuxcare.3","9.0.90-tuxcare.4","9.0.90-tuxcare.5","9.0.90-tuxcare.6","9.0.90-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.62-12.el9_2.1.tuxcare.els10"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.24"},{"fixed":"9.0.24-tuxcare.1"}]}],"versions":["9.0.24"],"bundled":32},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-tribes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.46"},{"fixed":"8.5.46-tuxcare.1"}]}],"versions":["8.5.46"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.39"},{"fixed":"9.0.39-tuxcare.2"}]}],"versions":["9.0.39","9.0.39-tuxcare.1"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-coyote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.13"},{"fixed":"9.0.13-tuxcare.2"}]}],"versions":["9.0.13","9.0.13-tuxcare.1"],"bundled":22},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.33"},{"fixed":"10.1.33-tuxcare.2"}]}],"versions":["10.1.33","10.1.33-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.46-1"}]}],"versions":["10.1.40-1"]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.11-1"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Debian:12","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.70-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.107-0+deb11u1"}]}],"versions":["9.0.43-1","9.0.43-2","9.0.43-2~deb11u1","9.0.43-2~deb11u10","9.0.43-2~deb11u11","9.0.43-2~deb11u12","9.0.43-2~deb11u2","9.0.43-2~deb11u3","9.0.43-2~deb11u4","9.0.43-2~deb11u5","9.0.43-2~deb11u6","9.0.43-2~deb11u7","9.0.43-2~deb11u8","9.0.43-2~deb11u9","9.0.43-3","9.0.53-1","9.0.54-1","9.0.55-1","9.0.58-1","9.0.62-1","9.0.63-1","9.0.64-1","9.0.64-2","9.0.65-1","9.0.67-1","9.0.68-1","9.0.68-1.1","9.0.70-1","9.0.70-2","9.0.95-1"],"bundled":11},{"source":"osv","ecosystem":"Debian:12","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb12u1"}]}],"versions":["10.1.10-1","10.1.13-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.20-1","10.1.23-1","10.1.25-1","10.1.25-1~bpo12+1","10.1.25-2","10.1.30-1","10.1.30-1~bpo12+1","10.1.31-1","10.1.33-1","10.1.33-1~bpo12+1","10.1.34-0+deb12u1","10.1.34-0+deb12u2","10.1.34-1","10.1.35-1","10.1.40-1","10.1.40-1~bpo12+1","10.1.46-1","10.1.6-1","10.1.6-1+deb12u1","10.1.6-1+deb12u2","10.1.7-1","10.1.8-1","10.1.9-1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.52-1~deb13u1"}]}],"versions":["10.1.40-1","10.1.46-1","10.1.52-1~deb12u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:13","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.15-1~deb13u1"}]}],"versions":["11.0.11-1","11.0.6-1"],"bundled":13},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.8"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.42"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.106"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.8"}]}],"versions":["11.0.0","11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M12","11.0.0-M13","11.0.0-M14","11.0.0-M15","11.0.0-M16","11.0.0-M17","11.0.0-M18","11.0.0-M19","11.0.0-M20","11.0.0-M21","11.0.0-M22","11.0.0-M24","11.0.0-M25","11.0.0-M26","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9","11.0.1","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.1.0-M1"},{"fixed":"10.1.42"}]}],"versions":["10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.16","10.1.17","10.1.18","10.1.19","10.1.2","10.1.20","10.1.23","10.1.24","10.1.25","10.1.26","10.1.28","10.1.29","10.1.30","10.1.31","10.1.33","10.1.34","10.1.35","10.1.36","10.1.39","10.1.4","10.1.40","10.1.41","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0.M1"},{"fixed":"9.0.106"}]}],"versions":["9.0.0.M1","9.0.0.M10","9.0.0.M11","9.0.0.M13","9.0.0.M15","9.0.0.M17","9.0.0.M18","9.0.0.M19","9.0.0.M20","9.0.0.M21","9.0.0.M22","9.0.0.M25","9.0.0.M26","9.0.0.M27","9.0.0.M3","9.0.0.M4","9.0.0.M6","9.0.0.M8","9.0.0.M9","9.0.1","9.0.10","9.0.100","9.0.102","9.0.104","9.0.105","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80","9.0.81","9.0.82","9.0.83","9.0.84","9.0.85","9.0.86","9.0.87","9.0.88","9.0.89","9.0.90","9.0.91","9.0.93","9.0.94","9.0.95","9.0.96","9.0.97","9.0.98","9.0.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat:tomcat-catalina","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.tomcat.embed:tomcat-embed-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"last_affected":"8.5.100"}]}],"versions":["8.5.0","8.5.100","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93","8.5.94","8.5.95","8.5.96","8.5.97","8.5.98","8.5.99"]},{"source":"osv","ecosystem":"Mageia:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.100-5.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-java-jdk8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el7","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el7jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el8","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el8jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:5.8::el9","package":"jws5-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.87-12.redhat_00011.1.el9jws"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el10","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el10jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el8","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el8jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_web_server:6.1::el9","package":"jws6-tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.1.36-7.redhat_00008.1.el9jws"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat9-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-el-5.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-jsp-3.1-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-servlet-6.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_4.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_8.7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-admin-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-docs-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-el-3.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-jsp-2.3-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-servlet-4.0-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"tomcat-webapps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el9_2.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-1.el8_10.6"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-5.el10_0.3"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.1.36-1.el10_0.2"}]}],"bundled":6},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.87-3.el9_6.3"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.145.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.36-3.145.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-150200.5.45.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-150200.86.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.43-150200.5.48.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9-150600.13.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9-150600.13.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.9-150600.13.6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP7","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.108-150200.91.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.115-3.160.1"}]}],"bundled":43},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.16-3~18.04.1","9.0.16-3ubuntu0.18.04.1","9.0.16-3ubuntu0.18.04.2","9.0.16-3ubuntu0.18.04.2+esm1","9.0.16-3ubuntu0.18.04.2+esm2","9.0.16-3ubuntu0.18.04.2+esm3","9.0.16-3ubuntu0.18.04.2+esm4","9.0.16-3ubuntu0.18.04.2+esm5","9.0.16-3ubuntu0.18.04.2+esm6","9.0.16-3ubuntu0.18.04.2+esm7","9.0.16-3ubuntu0.18.04.2+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.24-1","9.0.27-1","9.0.31-1","9.0.31-1ubuntu0.1","9.0.31-1ubuntu0.2","9.0.31-1ubuntu0.3","9.0.31-1ubuntu0.4","9.0.31-1ubuntu0.5","9.0.31-1ubuntu0.6","9.0.31-1ubuntu0.7","9.0.31-1ubuntu0.8","9.0.31-1ubuntu0.9","9.0.31-1ubuntu0.9+esm1","9.0.31-1ubuntu0.9+esm2","9.0.31-1ubuntu0.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"tomcat9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.43-3","9.0.54-1","9.0.55-1","9.0.58-1","9.0.58-1ubuntu0.1","9.0.58-1ubuntu0.1+esm1","9.0.58-1ubuntu0.1+esm2","9.0.58-1ubuntu0.1+esm3","9.0.58-1ubuntu0.1+esm4","9.0.58-1ubuntu0.2","9.0.58-1ubuntu0.2+esm1","9.0.58-1ubuntu0.2+esm2","9.0.58-1ubuntu0.2+esm3","9.0.58-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.10-1","10.1.14-1","10.1.15-1","10.1.16-1","10.1.16-1ubuntu0.1~esm1","10.1.16-1ubuntu0.1~esm2","10.1.16-1ubuntu0.1~esm3","10.1.16-1ubuntu0.1~esm4","10.1.55-1ubuntu2~24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.35-1","10.1.40-1","10.1.40-1ubuntu1","10.1.40-1ubuntu1.25.10.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.54-1","10.1.54-1ubuntu1","10.1.54-1ubuntu2","10.1.55-1ubuntu1","10.1.55-1ubuntu2","10.1.57~us1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.40-1ubuntu1","10.1.40-1ubuntu1.26.04.1","10.1.55-1ubuntu2~26.04.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.106-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.1.42-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tomcat11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.8-1.1"}]}],"bundled":3}],"products":[{"vendor":"apache","product":"tomcat"},{"vendor":"apache software foundation","product":"apache tomcat"}],"references":[{"url":"https://lists.apache.org/thread/m66cytbfrty9k7dc4cg6tl1czhsnbywk","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/06/16/2","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00009.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49125","tags":["web","advisory"]},{"url":"https://github.com/apache/tomcat/commit/7617b9c247bc77ed0444dd69adcd8aa48777886c","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/9418e3ff9f1f4c006b4661311ae9376c52d162b9","tags":["web","report"]},{"url":"https://github.com/apache/tomcat/commit/d94bd36fb7eb32e790dae0339bc249069649a637","tags":["web","report"]},{"url":"https://tomcat.apache.org/security-10.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-11.html","tags":["web"]},{"url":"https://tomcat.apache.org/security-9.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wc4r-xq3c-5cf3"},{"url":"https://access.redhat.com/errata/RHSA-2025:14177","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48976","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48988","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-48989","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49125","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52434","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52520","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-53506","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/2373309","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/2379386","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-14177.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14178","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-14178.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14181","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-14181.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1786763497.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55276","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49125.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-49125","tags":["advisory"]},{"url":"https://github.com/apache/tomcat","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0191.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34376","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2025/06/16/2","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48988","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1816","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48976","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11695","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/5.8/html/red_hat_jboss_web_server_5.8_service_pack_5_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2379386","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11695.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48976","tags":["advisory"]},{"url":"https://lists.apache.org/thread/fbs3wrr3p67vkjcxogqqqqz45pqtso12","tags":["article"]},{"url":"https://lists.apache.org/thread/w7dbnfyqn1yc05kbqqbbyct7wbomv7lf","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48988","tags":["advisory"]},{"url":"https://lists.apache.org/thread/nzkqsok8t42qofgqfmck536mtyzygp18","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49125","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52434","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52434","tags":["advisory"]},{"url":"https://lists.apache.org/thread/gxgh65004f25y8519coth6w7vchww030","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52520","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52520","tags":["advisory"]},{"url":"https://lists.apache.org/thread/trqq01bbxw6c92zx69kx2mw2qgmfy0o5","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-53506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53506","tags":["advisory"]},{"url":"https://lists.apache.org/thread/p09775q0rd185m6zz98krg0fp45j8kr0","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:11741","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_web_server/6.1/html/red_hat_jboss_web_server_6.1_service_pack_1_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_11741.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373309","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14177.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48989","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48989","tags":["advisory"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.44","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14178.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14179","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14179.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14180","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14180.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14181.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14182","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14182.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:14183","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_14183.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14177","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14178","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14179","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:14181","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502214-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243815","tags":["report"]},{"url":"https://bugzilla.suse.com/1244649","tags":["report"]},{"url":"https://bugzilla.suse.com/1244656","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49125","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502261-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242722","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502280-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502978-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1246318","tags":["report"]},{"url":"https://bugzilla.suse.com/1246388","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53506","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502979-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503024-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1243895","tags":["report"]},{"url":"https://bugzilla.suse.com/1246389","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-48989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52434","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261058-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216182","tags":["report"]},{"url":"https://bugzilla.suse.com/1258371","tags":["report"]},{"url":"https://bugzilla.suse.com/1258385","tags":["report"]},{"url":"https://bugzilla.suse.com/1259224","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-24122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-33037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-41079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43980","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-42252","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-24998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41080","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-45468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-21733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38286","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-54677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-24813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-55754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24733","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-49125","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-49125","title":"Apache Tomcat: Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:18:09.61Z","modified":"2025-11-03T20:05:06.721Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:24.825718Z"}],"euvd":[{"id":"EUVD-2025-18406","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:18:09Z","modified":"2025-11-03T20:05:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:32.896597Z"}],"ghsa":[{"id":"GHSA-wc4r-xq3c-5cf3","title":"Apache Tomcat - Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2025-11-03T23:01:01Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2025-49125","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.85Z","modified":"2026-06-17T09:30:47.307Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"CVE-2025-49125","title":"Apache Tomcat: Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T14:18:09.61Z","modified":"2026-10-28T02:30:28.541796532Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-49125","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.  This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions  may also be affected.   Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:24.85Z","modified":"2026-09-01T20:05:53.550932432Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-wc4r-xq3c-5cf3","title":"Apache Tomcat - Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:32:28Z","modified":"2026-09-10T03:50:26.000004953Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"OESA-2025-1644","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-48988)\n\nAuthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)","status":"published","published":"2025-06-20T11:08:44Z","modified":"2026-08-18T01:18:00.222779855Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"OESA-2025-1816","title":"tomcat security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.\r\n\r\nSecurity Fix(es):\n\nAllocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload.\n\nThis issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4.\n\nUsers are recommended to upgrade to versions 1.6 or 2.0.0-M4, which fix the issue.(CVE-2025-48976)\n\nAuthentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105.\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.(CVE-2025-49125)","status":"published","published":"2025-07-11T11:08:54Z","modified":"2026-08-18T01:18:34.579362368Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHSA-2025:11695","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 5.8.5 release and security update","status":"published","published":"2025-07-29T10:07:17Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:11741","title":"Red Hat Security Advisory: Red Hat JBoss Web Server 6.1.1 release and security update","status":"published","published":"2025-07-31T10:08:51Z","modified":"2026-10-09T10:13:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14177","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14178","title":"Red Hat Security Advisory: tomcat9 security update","status":"published","published":"2025-08-21T10:03:54Z","modified":"2026-10-09T10:14:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14179","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14180","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14181","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:55Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14182","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RHSA-2025:14183","title":"Red Hat Security Advisory: tomcat security update","status":"published","published":"2025-08-21T10:03:56Z","modified":"2026-10-09T10:14:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.599955Z"},{"id":"RLSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-09-08T14:19:16.612452Z","modified":"2025-09-08T15:03:16.580879Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:48.482776Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14179","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-03T20:19:16.34748Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.\n\nSecurity Fix(es):\n\n* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n\n* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n\n* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n\n* tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n\n* tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-04T00:50:08.535095Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"UBUNTU-CVE-2025-49125","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat.  When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-06-16T15:15:00Z","modified":"2026-11-11T09:39:14.252215887Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-11T10:01:07.920765Z"},{"id":"ALSA-2025:14177","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:02:22.332186276Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14178","title":"Important: tomcat9 security update","description":"Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:30:04.065723321Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"ALSA-2025:14181","title":"Important: tomcat security update","description":"Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.  \n\nSecurity Fix(es):  \n\n  * tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)\n  * tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)\n  * apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)\n  * tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames (CVE-2025-48989)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52520)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-52434)\n  * tomcat: Apache Tomcat denial of service (CVE-2025-53506)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-08-20T00:00:00Z","modified":"2026-10-29T11:32:27.691470691Z","updated_at":"2026-11-02T15:27:53.030731Z"},{"id":"BIT-tomcat-2025-49125","title":"Apache Tomcat: Security constraint bypass for pre/post-resources","description":"Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Tomcat. When using PreResources or PostResources mounted other than at the root of the web application, it was possible to access those resources via an unexpected path. That path was likely not to be protected by the same security constraints as the expected path, allowing those security constraints to be bypassed.\n\nThis issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.0 through 9.0.105.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions \nmay also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.","status":"published","published":"2025-07-10T10:47:18.953Z","modified":"2026-09-08T08:48:20.796185779Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1753056170","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 8.5.100.tuxcare.2.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:08.294363055Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1756253007","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.75-tuxcare.1.","status":"published","published":"2026-08-04T14:52:04Z","modified":"2026-11-02T19:45:08.567289918Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1759795579","title":"TuxCare security update for 6 packages (18 CVEs)","description":"TuxCare rebuilt 6 packages to address 18 CVEs. Fixed in 9.0.83-tuxcare.1.","status":"published","published":"2026-08-04T14:52:05Z","modified":"2026-10-30T07:30:07.718953578Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1764720465","title":"TuxCare security update for 5 packages (18 CVEs)","description":"TuxCare rebuilt 5 packages to address 18 CVEs. Fixed in 9.0.50-tuxcare.2.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:14.144527872Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1765411683","title":"TuxCare security update for 4 packages (15 CVEs)","description":"TuxCare rebuilt 4 packages to address 15 CVEs. Fixed in 9.0.87-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:10.572519586Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1766362095","title":"TuxCare security update for 4 packages (12 CVEs)","description":"TuxCare rebuilt 4 packages to address 12 CVEs. Fixed in 9.0.100-tuxcare.1.","status":"published","published":"2026-08-04T14:52:06Z","modified":"2026-11-02T19:45:13.410321439Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1768262917","title":"TuxCare security update for 6 packages (22 CVEs)","description":"TuxCare rebuilt 6 packages to address 22 CVEs. Fixed in 10.1.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.278630051Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1773188120","title":"TuxCare security update for 5 packages (23 CVEs)","description":"TuxCare rebuilt 5 packages to address 23 CVEs. Fixed in 9.0.46-tuxcare.1.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-11-02T19:45:15.814263441Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1781744120","title":"TuxCare security update for 2 packages (1 CVE)","description":"TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 9.0.90-tuxcare.8.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-11-02T19:45:34.536177495Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1786763497","title":"tomcat: Fix of 2 CVEs","description":"- CVE-2025-49125: require the request path to end at the mount point or continue\n  past it with a /, instead of testing the mount point as a bare string prefix,\n  so a PreResources or PostResources set mounted below the web application root\n  can no longer be reached via an unexpected path that is not covered by the\n  same security constraints; also strip a trailing / from webAppMount in all\n  cases, as upstream does, so a resource set mounted on a path ending in / keeps\n  resolving its nested paths under the stricter check\n- CVE-2026-55276: include the * and ** special roles and empty authorization\n  constraints when generating the effective web.xml, so the logged descriptor no\n  longer understates the security constraints that are actually in force","status":"published","published":"2026-08-15T03:11:48Z","modified":"2026-10-26T09:30:34.052782672Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1792575257","title":"TuxCare security update for 8 packages (32 CVEs)","description":"TuxCare rebuilt 8 packages to address 32 CVEs. Fixed in 9.0.24-tuxcare.1.","status":"published","published":"2026-10-21T09:34:17Z","modified":"2026-11-02T19:46:30.353719339Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792667085","title":"TuxCare security update for 7 packages (24 CVEs)","description":"TuxCare rebuilt 7 packages to address 24 CVEs. Fixed in 8.5.46-tuxcare.1.","status":"published","published":"2026-10-22T11:04:45Z","modified":"2026-11-02T19:46:30.557831164Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011037","title":"TuxCare security update for 5 packages (26 CVEs)","description":"TuxCare rebuilt 5 packages to address 26 CVEs. Fixed in 9.0.39-tuxcare.2.","status":"published","published":"2026-10-26T10:37:17Z","modified":"2026-11-02T19:46:31.628369017Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793011786","title":"TuxCare security update for 7 packages (22 CVEs)","description":"TuxCare rebuilt 7 packages to address 22 CVEs. Fixed in 9.0.13-tuxcare.2.","status":"published","published":"2026-10-26T10:49:46Z","modified":"2026-11-02T19:46:31.559502384Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793202343","title":"TuxCare security update for 3 packages (5 CVEs)","description":"TuxCare rebuilt 3 packages to address 5 CVEs. Fixed in 10.1.33-tuxcare.2.","status":"published","published":"2026-10-28T15:45:43Z","modified":"2026-11-02T19:46:32.592120933Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"DLA-4244-1","title":"tomcat9 - security update","status":"published","published":"2025-07-21T00:00:00Z","modified":"2026-03-09T02:09:38.37694Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6120-1","title":"tomcat10 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:11:28.926265Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6121-1","title":"tomcat11 - security update","status":"published","published":"2026-02-05T00:00:00Z","modified":"2026-03-09T02:08:55.570487Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2025-0191","title":"Updated tomcat packages fix security vulnerabilities","description":"FileUpload large number of parts with headers DoS. (CVE-2025-48988)\nSecurity constraint bypass for pre/post-resources. (CVE-2025-49125)\n","status":"published","published":"2025-06-25T05:31:45Z","modified":"2026-04-16T04:43:26.285732071Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15301-1","title":"tomcat-9.0.106-1.1 on GA media","description":"These are all security issues fixed in the tomcat-9.0.106-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:37.017176Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15302-1","title":"tomcat10-10.1.42-1.1 on GA media","description":"These are all security issues fixed in the tomcat10-10.1.42-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.880351Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15303-1","title":"tomcat11-11.0.8-1.1 on GA media","description":"These are all security issues fixed in the tomcat11-11.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:36.924688Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02214-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n - CVE-2025-46701: Refactored CGI servlet to access resources via WebResources (bsc#1243815).\n - CVE-2025-48988: Limited the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).\n - CVE-2025-49125: Expand checks for webAppMount (bsc#1244649).\n","status":"published","published":"2025-07-03T08:04:04Z","modified":"2026-02-04T03:20:37.187233Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02261-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\n- Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).\n- Fixed limits the total number of parts in a multi-part request and \n  limits the size of the headers provided with each part (bsc#1244656).\n- Fixed expand checks for webAppMount (bsc#1244649).\n- Hardening permissions (bsc#1242722)\n\nUpdate to Tomcat 10.1.42:\n\n  * Fixed CVEs:\n\n    + CVE-2025-46701: refactor CGI servlet to access resources via\n      WebResources (bsc#1243815)\n    + CVE-2025-48988: limits the total number of parts in a\n      multi-part request and limits the size of\n      the headers provided with each part (bsc#1244656)\n    + CVE-2025-49125: Expand checks for webAppMount (bsc#1244649)\n\n  * Catalina:\n\n    + Add: Support for the java:module namespace which mirrors the\n      java:comp namespace.\n    + Add: Support parsing of multiple path parameters separated by ; in a\n      single URL segment. Based on pull request #860 by Chenjp.\n    + Add: Support for limiting the number of parameters in HTTP requests\n      through the new ParameterLimitValve. The valve allows configurable\n      URL-specific limits on the number of parameters.\n    + Fix: 69699: Encode redirect URL used by the rewrite valve with the\n      session id if appropriate, and handle cross context with different\n      session configuration when using rewrite.\n    + Add: #863: Support for comments at the end of lines in text rewrite\n      map files to align behaviour with Apache httpd. Pull request\n      provided by Chenjp.\n    + Fix: 69706: Saved request serialization issue in FORM introduced\n      when allowing infinite session timeouts.\n    + Fix: Expand the path checks for Pre-Resources and Post-Resources\n      mounted at a path within the web application.\n    + Fix: Use of SSS in SimpleDateFormat pattern for AccessLogValve.\n    + Fix: Process possible path parameters rewrite production in the\n      rewrite valve.\n    + Fix: 69588: Enable allowLinking to be set on PreResources,\n      JarResources and PostResources. If not set explicitly, the setting\n      will be inherited from the Resources.\n    + Add: 69633: Support for Filters using context root mappings.\n    + Fix: 69643: Optimize directory listing for large amount of files.\n      Patch submitted by Loic de l'Eprevier.\n    + Fix: #843: Off by one validation logic for partial PUT ranges and\n      associated test case. Submitted by Chenjp.\n    + Refactor: Replace the unused buffer in\n      org.apache.catalina.connector.InputBuffer with a static, zero\n      length buffer.\n    + Refactor: GCI servlet to access resources via the WebResource API.\n    + Fix: 69662: Report name in exception message when a naming lookup\n      failure occurs. Based on code submitted by Donald Smith.\n    + Fix: Ensure that the FORM authentication attribute\n      authenticationSessionTimeout works correctly when sessions have an\n      infinite timeout when authentication starts.\n    + Add: Provide a content type based on file extension when web\n      application resources are accessed via a URL.\n  * Coyote\n    + Refactor: #861: TaskQueue to use the new interface RetryableQueue\n      which enables better integration of custom Executors which provide\n      their own BlockingQueue implementation. Pull request provided by\n      Paulo Almeida.\n    + Add: Finer grained control of multi-part request processing via two\n      new attributes on the Connector element. maxPartCount limits the\n      total number of parts in a multi-part request and maxPartHeaderSize\n      limits the size of the headers provided with each part. Add support\n      for these new attributes to the ParameterLimitValve.\n    + Refactor: The SavedRequestInputFilter so the buffered data is used\n      directly rather than copied.\n\n  * Jasper:\n\n    + Fix: 69696: Mark the JSP wrapper for reload after a failed\n      compilation.\n    + Fix: 69635: Add support to jakarta.el.ImportHandler for resolving\n      inner classes.\n    + Add: #842: Support for optimized execution of c:set and c:remove\n      tags, when activated via JSP servlet param\n      useNonstandardTagOptimizations.\n    + Fix: An edge case compilation bug for JSP and tag files on case\n      insensitive file systems that was exposed by the test case for\n      69635.\n\n  * Web applications:\n\n    + Fix: 69694: Improve error reporting of deployment tasks done using\n      the manager webapp when a copy operation fails.\n    + Add: 68876: Documentation. Update the UML diagrams for server\n      start-up, request processing and authentication using PlantUML and\n      include the source files for each diagram.\n\n  * Other:\n\n    + Add: Thread name to webappClassLoader.stackTraceRequestThread\n      message. Patch provided by Felix Zhang.\n    + Update: Tomcat Native to 2.0.9.\n    + Update: The internal fork of Apache Commons FileUpload to 1.6.0-RC1\n      (2025-06-05).\n    + Update: EasyMock to 5.6.0.\n    + Update: Checkstyle to 10.25.0.\n    + Fix: Use the full path when the installer for Windows sets calls\n      icacls.exe to set file permissions.\n    + Update: Improvements to Japanese translations provided by tak7iji.\n    + Fix: Set sun.io.useCanonCaches in service.bat Based on pull request\n      #841 by Paul Lodge.\n    + Update: Jacoco to 0.8.13.\n    + Code: Explicitly set the locale to be used for Javadoc. For\n      official releases, this locale will be English (US) to support\n      reproducible builds.\n    + Update: Byte Buddy to 1.17.5.\n    + Update: Checkstyle to 10.23.1.\n    + Update: File extension to media type mappings to align with the\n      current list used by the Apache Web Server (httpd).\n    + Update: Improvements to French translations.\n    + Update: Improvements to Japanese translations provided by tak7iji. \n","status":"published","published":"2025-07-09T17:40:32Z","modified":"2026-02-04T03:33:00.695409Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02280-1","title":"Security update for tomcat","description":"This update for tomcat fixes the following issues:\n\n- CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources (bsc#1243815).\n- CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part (bsc#1244656).\n- CVE-2025-49125: Fixed expand checks for webAppMount (bsc#1244649).\n\nOther bugfixes:\n\n- Made permissions more secure (bsc#1242722) \n","status":"published","published":"2025-07-10T16:04:29Z","modified":"2026-03-23T04:47:42.373765Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:02978-1","title":"Security update for tomcat10","description":"This update for tomcat10 fixes the following issues:\n\nUpdated to Tomcat 10.1.43i:\n- CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)\n- CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)\n\nOther:\n- Correct a regression in the fix for CVE-2025-49125 that\n  prevented access to PreResources and PostResources when mounted below the\n  web application root with a path that was terminated with a file\n  separator.\n","status":"published","published":"2025-08-25T13:45:39Z","modified":"2026-03-23T04:48:42.170623Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02979-1","title":"Security update for tomcat11","description":"This update for tomcat11 fixes the following issues:\n\nUpdated to Tomcat 11.0.9\n- CVE-2025-52520: Fixed integer overflow can lead to DoS for some unlikely configurations of multipart upload (bsc#1246388)\n- CVE-2025-53506: Fixed uncontrolled resource HTTP/2 client consumption vulnerability (bsc#1246318)\n    \nOther:\n- Correct a regression in the fix for CVE-2025-49125 that\n  prevented access to PreResources and PostResources when mounted below the\n  web application root with a path that was terminated with a file\n  separator.\n","status":"published","published":"2025-08-25T13:46:18Z","modified":"2026-03-23T04:49:49.720655Z","updated_at":"2026-11-02T15:53:57.111474Z"}]},"sources_more":{"osv":2}}